How Bosla protects your store and your customers' data

Your customers' names, phones and addresses are your business. Here is exactly how Bosla keeps them safe.

Your data stays yours

Every workspace is isolated at the data layer. Each query is scoped to your workspace, so one store can never read another's orders, chats or customers.

Encryption

• All traffic is encrypted in transit over HTTPS/TLS.
• Connected-account credentials (WhatsApp, Shopify, courier keys, your own OpenAI key) are encrypted at rest with AES-256-GCM.
• Passwords are stored as bcrypt hashes, never in plain text.
• Developer API keys are stored only as SHA-256 hashes and shown once.

Access control

• Two-factor authentication (MFA) for accounts.
• Workspace roles (owner, admin, member): a customer-service seat sees the inbox, not your costs or exports.
• API keys are named and scoped to exactly what they may read or write.
• Changing a teammate's password signs them out everywhere.

Integrations and webhooks

• Incoming webhooks are verified (by signature or a secret per-workspace token) before anything is processed.
• Outgoing webhooks to your systems are signed, and blocked from reaching private networks.
• Every Bosla staff action inside a workspace is written to an audit log.

Nothing disappears by accident

Deleting a channel or a conversation is a soft delete: it can be restored, so one wrong tap never wipes your inbox.

Report a problem

Found a security issue? Contact us through the booking page and we'll respond quickly.